CVE-2024-31215 Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check
Attacker can force MobSF server to access internal services via SSRF in Firebase check, potentially exposing internal infrastructure data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-31215?
CVE-2024-31215 is a medium-severity server-side request forgery vulnerability in Mobile-Security-Framework-MobSF, published on 4 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.
Weakness: CWE-918
Which versions are affected by CVE-2024-31215?
3 open source packages ship an affected version, including mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsf PyPI | All versions | 3.9.8 |
mobsf PyPI | All versions | 3.9.8 |
mobsf PyPI | All versions | 3.9.8 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2024-31215?
Upgrade mobsf to 3.9.8 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-31215 being exploited?
There is no known exploitation of CVE-2024-31215 in the wild and no public exploit code.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-wpff-wm84-x5cx, PYSEC-2026-1676.